Independent Expert Group for the Unlocking the Value of Data Programme report: SG response

Scottish Government Response to the Independent Expert Group for the Unlocking the Value of Data programme

Summary

The report by the Independent Expert Group (IEG) contains a proposed policy statement, seven guiding principles and a set of 19 recommendations, designed to encourage ethical and transparent access to, and use of, public sector personal data in Scotland.

The Scottish Government’s response to this report has been co-produced with the Practitioner Forum for the Unlocking the Value of Data programme and associated stakeholders.

In summary, our overall assessment is that the report, and the accompanying literature reviews, make an important contribution to the body of evidence which will collectively inform our iterative approach to this area of work. Many of the report’s recommendations, discussed in further detail below, speak to and validate current programmes and initiatives, undertaken or planned, by the Scottish Government, and its partners, in this area (Annex A).

The aims and aspirations of this programme can only be achieved with the public's support, engagement and trust. We therefore need to understand public attitudes to data, which are often complex and nuanced, as well as the sensitivities associated with harnessing personal data for ethical innovation. Building a foundation of public trust will be central to each iteration of the UVOD programme.

Personal data is defined in the UK GDPR as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.

The IEG has defined the ‘private sector’ as ‘the segment of the economy owned, managed and controlled by individuals and organisations seeking to generate profit’. The group’s deliberations on private sector access to public sector personal data in Scotland reinforce the common observation that this is a complex, constantly-evolving landscape with political, legal and policy dimensions that need to be considered.

The Scottish Government will consider the policy statement, seven guiding principles and 19 recommendations proposed by the Independent Expert Group in turn.

Proposed Policy Statement

‘We consider that when public sector personal data is used by the private sector, this should be done in a way which delivers public benefit and is in the public interest. This requires consideration of matters including:

• the potential benefits and consequences of data use for the public;
• people’s rights (in particular the right to privacy); and
• any value (and also any costs and harm) that is expected to be generated by the data use (viewing value in the broadest economic, social and/or environmental terms), including how these benefits and value will be shared with the public.'

This policy statement aligns with the Scottish Government’s position, namely that the use of public sector personal data by the private sector must be lawful, ethical, trustworthy, and in the public interest, across the full spectrum of data-driven activities. Access to this data must be contingent on demonstrable public benefit associated with its potential use. Furthermore, if economic value is produced by the private sector using public sector personal data, this value must be shared with the public sector and the people of Scotland, for instance through appropriate benefit-sharing mechanisms.

Aligning with this policy position, Research Data Scotland (RDS)^[7] will take forward work, on behalf of the Scottish Government, to develop a common operational framework, to support simplified and faster access to public sector data, subject to appropriate balance and controls. The initial scope is access to de-identified case-level public sector data for research purposes, by or with a private sector company. This is envisaged as a series of pilots to test and operationalise Scottish Government policy and will inform future policy iteration and implementation. It will build on the ‘Five Safes’ Framework^[8], and reflect international best practice.

The requirement for benefits and consequences of data use for the public to be considered aligns with approaches by approval bodies such as the Public Benefit and Privacy Panel for Health and Social Care (PBPP)^[9] and the Statistics Public Benefit and Privacy Panel (SPBPP)^[10], when assessing applications to access and use data for research. Our aim is to support data controllers, and their approval panels, to make informed judgements and consistent decisions about the value generated by data use.

Public engagement activities demonstrate that public perspectives become conditionally supportive through dialogue, and where there is a clear and demonstrable public benefit, or public good, associated with the use of personal data.

According to the Unlocking the Value of Data: Public engagement literature review, “There is widespread conditional acceptance of private sector use of public sector data, especially among informed publics. Acceptability is most conditioned by the rationales for the data use, but also by the type of data being used and the type of private sector organisation using it.” This finding is supported by the Scottish Government’s Public Dialogue on the Use of Data in Scotland project^[11], and National Data Guardian research^[12].

We recognise the potential value of benefit-sharing mechanisms to support ethical data use for innovation and research. The Literature Review: Exploring data value and benefit-sharing identifies guiding principles to assist in designing an appropriate framework for public sector personal data benefit-sharing, including “proportionality, transparency, public engagement, co-creation of the concept of value, legal certainty and respect for ethical values and norms”. As will be discussed later, a focus on benefit-sharing is identified as a longer-term objective of the programme.